meilisearch / mini-dashboard

mini-dashboard for Meilisearch
https://edge-preview-meili.vercel.app
MIT License
228 stars 54 forks source link

fix(security): minimatch ReDoS vulnerability #513

Closed mdubus closed 4 months ago

mdubus commented 4 months ago

Pull Request

What does this PR do?

The minimatch package has a vulnerability issue with versions < 3.0.5. This package is used internally through recursive-readdir:

Capture d’écran 2024-05-14 à 10 34 44

The problem is that recursive-readdir is used by react-script (create-react-app), which is not maintained anymore.

To fix this issue, the package.json has been updated with the resolutions field to update minimatch to the v3.0.5 (fixing the vulnerability) for the package using the vulnerable version (recursive-readdir)

This should help fixing the vulnerability issue.

PR checklist

Please check if your PR fulfills the following requirements:

Thank you so much for contributing to Meilisearch!

curquiza commented 4 months ago

bors merge

meili-bors[bot] commented 4 months ago

Build succeeded: